
AUTOMATIC SELECTION OF AN ON-CHIP ANCILLARY INTERNAL 
CLOCK GENERATOR UPON RESETTING A DIGITAL SYSTEM 

Field of the Invention 
[0001] The present invention relates to digital 
logic systems including a reset signal generator for 
resetting a system at power-up and/or during operation, 
and a clock generator for generating a main clock 
signal that is distributed to functional circuits of 
the system. 

Background of the Invention 
[0002] Initialization of digital logic systems at 

power-up or at certain occurrences during operation is 
a critical phase. Automotive applications as well as 
many other micro-controller based supervising and 
diagnostic systems must ensure the highest level of 
safety, including diagnostic capabilities even under 
harsh environmental conditions. To ensure that the 
system is able to recover from a malfunction and 
perform appropriate corrective actions under any 
circumstances, it becomes important that the system be 
able to correctly exit from a system reset phase. 
[0003] Apart from ensuring the correct generation of 
the reset signal, it is fundamentally important to 
timely provide the necessary clock signal to all the 
functional circuits of the system. Because of these 
requirements in practically any safety type system, 
many approaches have been developed. Most of these 



approaches are based on the availability of multiple 
clock inputs to the system. The system can switch from 
a failing clock source to a correctly working one, 
either under microprocessor control or by appropriate 
hardware functioning independently and/or cooperatively 
with the application software running on the system. 
[0004] One known approach is described in U.S. 
Patent No. 5,510,741 Childs, in which a reset and clock 
circuit provides a valid power-up reset signal prior to 
distribution of a clock signal for placing the system 
in a known state. Another reset and clock circuit 
maintains distribution of the clock signal for a 
predetermined time interval following a drop of the 
power supply voltage. 

[0005] Notwithstanding the efforts so far expended 

there is still a need for a relatively straightforward 
and cost effective implementation capable of preventing 
corruption or loss of data that may occur because of 
glitches or other imperfections of the externally 
generated main clock signal being distributed to the 
functional circuits of the system. This is during the 
critical exiting from a system reset phase, and the 
resumption of normal operation of the system, whether 
it follows a power-up or an execution of a recovery 
routine from a malfunction. 

Siammary of the Invention 
[0006] In view of the foregoing background, an 

object of the present invention is to provide a 
straightforward and effective approach for 
automatically selecting for distribution to the 
functional circuits of a digital logic system an 
internally generated ancillary clock signal by 
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temporarily deselecting the externally generated main 
clock signal at any reset, and thereafter switching 
back to distribute the externally generated main clock 
signal after having verified a certain number of main 
clock edges following a reset signal . 

[0007] To complete the reset phase and ensure that 

system is gracefully put into a safe state in case of 
an external clock failure across a reset event, the 
stability of an internal clock generator is to be 
ensured. In other words, the internal clock generator 
should be stable enough (after relaxation) to be able 
to allow the system to run diagnostics and signal the 
failure of the system clock. 

[0008] The maximum frequency of the internally 

generated ancillary clock should remain lower than a 
safe value for assuring that no part of the device may 
malfunction when fed with the internally generated 
clock. This is assured by employing an internal clock 
having a frequency lower than the frequency of the 
externally generated main system clock. 

[0009] By including an on-chip (internal) ancillary 
clock generator having a sufficient short-term 
frequency stability to ensure a stable clock frequency 
for the normal duration of a reset phase, and by 
automatically selecting an internally generated 
ancillary clock in lieu of the externally generated 
main clock for a programmable interval of time, 
corresponding to a certain number of main clock edges 
to be correctly monitored before reverting to 
distribute the main clock signal throughout the system, 
the probability of corruption or loss of data during 
the critical phase of completing the reset and resuming 
normal operation may be made practically negligible. 



[0010] The added ancillary internal clock generator 

may be a straightforward ring/RC oscillator that is 
slightly affected in its functionality by the external 
environmental conditions and thermo-mechanical 
stresses. Though unsuitable to ensure a long-term 
stability such as provided by a quartz crystal 
stabilized external main clock generator, the ancillary 
internal ring/RC oscillator does not suffer from 
thermo-mechanical stresses and other abruptly changing 
environmental conditions that, by contrast, are likely 
to severely effect short term stability of the main 
external clock generator. 

[0011] According to the present invention, during 

the critical phases of reset and of resuming normal 
operation, whether at power up or at any other moment 
of operation of the system, initialization errors 
following a reset that may arise from accidental 
concurrent imprecisions of the externally generated 
main clock signal are effectively prevented. 

Brief Description of the Drawings 
[0012] FIG. 1 is a block diagram of a digital logic 

system including an ancillary clock generator and a 
clock selection device in accordance with the present 
invention; and 

[0013] FIG. 2 is a more detailed block diagram of 

the digital logic system illustrated in FIG. 1. 

Detailed Description of the Preferred Embodiments 
[0014] Referring to FIG. 1, the integrated digital 

logic system is formed in an IC chip identified by the 
partial dotted line contour. As shown, a main external 
clock signal that may be generated by a dedicated 
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crystal oscillator is fed to the integrated system. - 
Moreover, the system receives appropriate reset 
commands generated by dedicated circuitry according to 
common practices in the art. 

[0015] According to the present invention, an 
ancillary internal clock generator (OSCILLATOR) , for 
example, in the form of a ring/RC oscillator having 
sufficient short-term frequency stability with respect 
to the normal duration of a reset phase, is integrated 
on the system chip. Its output is coupled to one input 
node of a selection multiplexer, to a second input node 
of which is fed the externally generated main clock 
signal . 

[0016] The selected clock is made available at the 

output of the multiplexer and is distributed to the 
functional circuits of the system (SYSTEM CLOCK) . 
Automatic selection of the ancillary internally 
generated clock signal is implemented upon the arrival 
of a system reset pulse to the resettable shift 
register (FF-DELAY) , which is fed with the externally 
generated main clock. 

[0017] The edge triggered resettable shift register 
(FF-DELAY) deselects the internally generated ancillary 
clock, which is automatically selected at the arrival 
of the system reset pulse, and selects the externally 
generated "main clock after detecting a programmable 
number of main clock edges following the reset pulse. 
[0018] Moreover, the shift register (FF-DELAY) acts 

as a filter for glitches that may be present in the 
external clock signal. Glitches on the external clock 
are potentially dangerous since they can force the 
delay block (FF-DELAY), i.e., the mux selector, to 
change state, and consequently, prematurely and unduly 
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switch the clock to a still unstable external source. 
The deeper (i.e., the larger the number of stages of 
the shift register) the multiplexer selecting shift 
register (FF-DELAY) is designed, the more robust the 
structure is against glitches based upon the hypothesis 
that a glitch may determine a spurious extra clock 
cycle. Theoretically, a glitch can even be so short to 
induce incorrect states in the logic circuitry it 
reaches (like a timing violation) . To contrast this, 
the shift register may be designed to minimize such an 
effect . 

[0019] For example, the external clock can be 

applied to a single toggle-type flip-flop whose output 
is then fed in lieu of the external clock to the rest 
(input) of the edge- triggered resettable shift register 
(counter) . In this way a glitch may be able to corrupt 
only the first flip-flop but the effect of this anomaly 
would be significantly reduced at the output of the 
shift register, thus preventing spurious selections in 
the multiplexer. 

[0020] The result is that the system switches to the 
externally generated main clock only after correct 
activity of the external main clock generator has been 
verified. This prevents the occurrence of corruptions 
due to glitches or imprecisions that could accidentally 
occur on the externally generated main clock signal 
during the critical reset phase. 

[0021] The ancillary internal clock generator has 

sufficient short-term frequency stability covering the 
expected duration of a reset phase, and differently 
from the external main clock generator, is much less 
likely to be affected by external environmental 
conditions and thermo-mechanical stresses. The number 
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of external clock edges to be counted before returning 
to distribute the externally generated main clock 
signal can be programmed according to needs and 
according to the stability characteristics of the 
ancillary internal clock generator. 

[0022] A sample embodiment of the present invention 
in a common microcontroller system is schematically 
illustrated in FIG. 2. The clock signal generated by 
the device is input to a circuit CLOCK & RESET 
DISTRIBUTION that distributes the recovered clock and 
the reset signal to all the functional blocks of the 
mi c rocont rol 1 er sy s t em . 
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